Drawing on the work of Mishaal Khan and of Matthew K. Sharp and Kyriakos “Rock” Lambros, this article explores how the CISO role has changed, what executives now expect from it, and the capabilities security leaders need to meet those expectations. Those capabilities include translating technical risk into financial terms, building influence across the business, and designing governance that speeds the organization up. It closes with questions to help you see where your organization sits today.
How The CISO Role Got Here
The CISO role is roughly three decades old, and its center of gravity has moved several times. Understanding that path explains why many security leaders still carry responsibilities, and a reputation, that were shaped for an earlier period.
| Period | What Changed |
|---|---|
| 1994 | Hackers steal $10 million from Citibank in one of the earliest major cybercrimes. |
| 1995 | Citibank creates a dedicated cybersecurity leadership role and hires Steve Katz as the world’s first CISO. |
| 2000s | Legislators pass new data privacy and security laws. Many companies turn to CISOs to manage regulatory compliance. |
| 2010s | High-profile breaches at Target, Yahoo, and others reach mainstream attention. The CISO role grows in importance and prominence. |
| 2020s | Digital transformation accelerates and the threat landscape intensifies. CISOs become increasingly influential at the board level. |
What Was the Historic Role of the CISO?
CISOs were once seen as technical responders who appeared during system failures and crises. They were often overworked and under-resourced and were perceived as technical risk gatekeepers rather than strategic enablers.
The Strategic Shift
Digital transformation and evolving threats have moved CISOs into a different position. Modern CISOs are expected to integrate risk across the business, model financial exposure, and influence organizational culture across departments. When that influence is real, the effect shows up as competitive advantage, resilience, and stronger brand credibility.
Where CISOs Spend Their Effort, and Where It Needs to Go
One framework often cited in this discussion sorts CISO work into four roles: Strategist, Advisor, Guardian, and Technologist. The figures below compare the share of emphasis CISOs currently place on each role with the share they would ideally place on it.
| Role | What it Covers |
|---|---|
| Strategist | Aligning business and cyber risk strategy, and driving change that manages risk through well-chosen investments. |
| Advisor | Working with the business to educate, advise, and shape activities that carry cyber risk implications. |
| Guardian | Protecting business assets by understanding the threat landscape and the effectiveness of the cyber risk program. |
| Technologist | Assessing and implementing security technologies and standards to build organizational capability. |
The pattern is clear. Guardian and Technologist work remains essential, and no one is suggesting otherwise. The argument is that the balance has to tilt toward the roles that connect security to business decisions.
What Is the Phantom CISO Problem?
For years, CISOs operated in a state often described as “phantom leadership”: present, accountable, and indispensable, yet organizationally ambiguous. Echelon’s framing of the phantom CISO draws on themes from Khan’s book [1].
The ambiguity shows up in two ways:
CISOs are responsible for critical risk decisions yet excluded from the forums where business strategy is set.
CISOs are expected to prevent breaches, yet denied the authority, resources, or organizational clarity needed to do so.
The result is structural misalignment. The enterprise asks the CISO to safeguard it, but the organization’s chart treats the role as an IT deputy rather than an executive. The “phantom CISO” syndrome often leaves leaders isolated, carrying responsibility without authority and without cross-functional sponsors. The modern shift corrects this by bringing the CISO into the open and positioning them as a business leader.
How Does a CISO Move from Phantom to Power Broker?
Moving out of the shadows is partly a matter of visibility, communication, and relationship-building. It is less about title than about who is in the room, and how early.
The modern CISO has to be a negotiator, a communicator, a relationship-builder, and a bridge between highly technical teams and non-technical executives. In practice, that includes:
Building trust with CEOs and boards by communicating cyber risk in terms of business priorities.
Engaging early with legal, finance, and operations to build enterprise-wide risk awareness and alignment.
Telling the story well. Storytelling lets CISOs turn complex threats into narratives about resilience and opportunity.
Done consistently, this moves the CISO into a position that influences decisions across finance, legal, operations, engineering, HR, supply chain, and beyond. In this context, “power broker” does not mean positional authority. It means relationship capital: the credibility to drive adoption without escalating every disagreement. The CISO Evolution treats relationship-building, communication, and cross-functional collaboration as essential to advancing cybersecurity priorities.
What This Means for Your Organization
Whether you lead security or sit on the team that works with the CISO, a few questions can show where the organization sits on the curve.
Is the CISO part of strategy, M&A, product, and AI adoption conversations, or brought in after decisions are made?
Do security reports connect to revenue, margin, and customer commitments, or only to operational counts?
Are security approvals manual gates, or automated guardrails with pre-approved patterns?
Do the CISO’s authority and resources match what they are held accountable for?
Does the security function include financial, communication, and organizational design skills as well as technical ones?
The era of the phantom CISO is ending. Organizations are not well served by a guardian of “no.” They need a leader who can turn uncertainty into advantage, risk into strategy, and security into a driver of growth. The change asks as much of the organization as it does of the CISO: a seat in the right conversations, authority that matches accountability, and reporting that speaks to the business.